Preventing users from sharing accounts

[jmiller38]

I have completed a site using Coldfusion. When a user buys a subscription to the site, the license is for that person on the computer he purchased the subscription on. I do not want people sharing passwords. I have implemented a few different authentication methods including an activeX controller that puts a unique ID on the person computer, but this solution seems very cumbersome. If possible I would like a solution that is less cumbersome and works in the majority of cases. If activeX is the only way to go, then I will do that. I’m sure some of you have faced this type of problem before and this is probably a common problem. I’m just looking for a good solution that works in the majority of cases and does not make it too difficult for the user. Possibly something that uniquely identifies the user.

 

[imstillatwork]

Think about application scope variable that every session can access...

 

[krisbrixon]

That is a tough one. My first thought was use their IP address, but that changes too often for most people.

You can log access and if the same id logs in twice at the same time then log off the first person. However, there are situations where it might be the valid person both times, like changing from the computer in the bedroom to the computer in the living room or changing from IE to FireFox.

You can log access and limit the number of times something is accessed. (Depends on what your site is selling.) Say a download can only be started three times. This allows for errors and failed downloads. Since you can only tell when a download started and not if it was sucessful.

If someone really wants to let other people use what they paid for they will find a way. Like download it and then serve it up on bittorent or burn a CD for their friends.

Did this help or spur any other ideas?

Kris Brixon

If you're not failing every now and again, it's a sign you're not doing anything very innovative.
- W. Allen